ADR-015: the site-literal check was matching nothing, and had been all along

The patterns are assembled from fragments so the published script does not
contain the strings it greps for. They used the apostrophe-escape form
('a'\''b'), which EMBEDS a literal apostrophe, instead of the concatenation form
('a''b'), which joins them. Every pattern therefore carried a stray quote in the
middle and could never match a line of real code, so the check passed everything
from the day it was written.

Verified the only way that means anything: plant a violation, watch it fail,
revert. Fixed, it immediately found 25 real hits.

Among them, in seven places, the default ServiceNow URLs - one organisation's QA
tenant, shipped with the integration ENABLED. Any site that had not configured
ServiceNow still rendered ticket links, pointing its technicians at a tenant
they cannot reach; an adopting site would have been pointed into somebody else's
instance entirely. There is no sensible cross-site default for "which ServiceNow
is yours", so the URLs ship blank and the integration ships off, matching the
Zabbix block that got this right.

A named SaaS tenant is as site-specific as a hostname, so it joins the patterns.
Colocated .spec.js files are excluded the same way tests/ already is: sample data
naming a facility is not a shipped literal.

shopdb/core/api/search.py

@@ -72,13 +72,12 @@ def _require_enabled(name):
     if pm and not pm.registry.is_enabled(name):
         raise ImportError(f'{name} plugin disabled')
 
-# Shipped GE defaults. Settings override these per-site; identical fallbacks
-# live here so this consumer works even if the settings seed has not run.
-SERVICENOW_URL_DEFAULT = (
-    'https://geaerospaceqa.service-now.com/now/nav/ui/search/'
-    '0f8b85d0c7922010099a308dc7c2606a/params/search-term/{ticket}/'
-    'global-search-data-config-id/c861cea2c7022010099a308dc7c26041/'
-)
+# Fallbacks for when the settings seed has not run. The ServiceNow URL is BLANK
+# on purpose and must stay that way: a hardcoded tenant here would link one
+# site's technicians into another site's ServiceNow, and the code below already
+# treats a blank URL as "ServiceNow not configured" and renders tickets as plain
+# text. There is no sensible cross-site default for a tenant URL.
+SERVICENOW_URL_DEFAULT = ''
 SERVICENOW_PREFIXES_DEFAULT = 'GEINC,GECHG,GERIT,GESCT'
 EMPLOYEEID_PATTERN_DEFAULT = r'^\d{9}$'
 
@@ -108,9 +107,12 @@ def _get_search_integrations():
         prefixes_raw = SERVICENOW_PREFIXES_DEFAULT
     prefixes = [p.strip() for p in str(prefixes_raw).split(',') if p.strip()]
 
+    # Missing means unconfigured, and unconfigured means OFF - matching the
+    # shipped default. Defaulting to True here made a site with no ServiceNow
+    # settings at all behave as though the integration were on.
     servicenow_enabled = settings.get('servicenow_enabled')
     if servicenow_enabled is None:
-        servicenow_enabled = True
+        servicenow_enabled = False
 
     servicenow_url = settings.get('servicenow_search_url')
     if servicenow_url is None: